diff --git a/argocd/applications/woodpecker.yaml b/argocd/applications/woodpecker.yaml
index 54a1ac5..698b7e8 100644
--- a/argocd/applications/woodpecker.yaml
+++ b/argocd/applications/woodpecker.yaml
@@ -6,13 +6,11 @@ metadata:
   namespace: argocd
 spec:
   project: k-space.ee
-  sources:
-    - repoURL: git@git.k-space.ee:k-space/kube.git
-      targetRevision: HEAD
-      path: woodpecker
-    - repoURL: 'git@git.k-space.ee:secretspace/kube.git'
-      targetRevision: HEAD
-      path: woodpecker
+  source:
+    # also depends on git@git.k-space.ee:secretspace/kube.git
+    repoURL: git@git.k-space.ee:k-space/kube.git
+    targetRevision: HEAD
+    path: woodpecker
   destination:
     server: 'https://kubernetes.default.svc'
     namespace: woodpecker
diff --git a/woodpecker/kustomization.yaml b/woodpecker/kustomization.yaml
index 7d8b122..b0023db 100644
--- a/woodpecker/kustomization.yaml
+++ b/woodpecker/kustomization.yaml
@@ -21,9 +21,10 @@ helmCharts:
     server:
       ingress:
         enabled: true
-        ingressClassName: treafik
+        # ingressClassName: treafik # too new
         annotations:
           external-dns.alpha.kubernetes.io/target: traefik.k-space.ee
+          kubernetes.io/ingress.class: traefik
           traefik.ingress.kubernetes.io/router.entrypoints: websecure
         hosts:
         - host: woodpecker.k-space.ee
@@ -50,12 +51,6 @@ helmCharts:
       #   enabled: false
   version: 3.0.7
 
-secretGenerator:
-  - name: woodpecker-gitea-oauth2
-    envs:
-      - woodpecker-gitea.env
-  - name: woodpecker-db
-    literals:
-      - WOODPECKER_DATABASE_DRIVER=mysql
-    envs:
-      - woodpecker-db.env
+# secrets (.env): woodpecker-gitea-oauth2, woodpecker-db
+resources:
+- ssh://git@git.k-space.ee/secretspace/kube/woodpecker